Lost remote and would like to lower to flat

Background

My spouse and I recently purchased a Tempurpedic bed with an Ergo base. We previously had a Sleep Number adjustable bed which came with two remotes and I was surprised that Tempurpedic didn't support a remote for each side of the bed. I decided to order a second remote anyway to see if I could find a way to pair them both. After confirming that both would not simultaneously pair with the base, I cracked open the remote and identified the microcontroller inside and found a way to clone the original remote.

There are plenty of cheaper options for beds, mattresses, debuggers, etc. I'm approaching this project to fulfill a desire and I already have a bunch of tools at my disposal. I hope this guide helps someone else in the same situation or can give a thorough-enough overview of my process to be instructive to someone who's learning about hardware hacking in general.

Cheers and good luck!

Edits: Formatting...

Context/Procedure Photos

https://imgur.com/a/HCbFYha

Procedure Overview

Estimated time (with everything in-place): 30-60 minutes

1. Prepare remote controls - pair main remote with bed, open battery comparments

2. Obtain the necessary hardware (Extra remote, SWD debugger, jumper wires, etc)

3. Install the necessary software ( nrfjprog or OpenOCD )

4. Connect jumper wires to SWD debugger

5. Connect to the primary remote and dump the firmware

6. Optional: Connect to the secondary remote and dump the firmware

7. Optional: Compare firmware files using diff command

8. Upload primary remote firmware to secondary remote

9. Enjoy the convenience of having two remotes!

Difficulty: Easy/Moderate??

I'm not sure exactly how to rate this... Easy for a moderately-experienced user? Moderately difficult for a novice? Here are some skill requirements and considerations for this project:

• Basic command-line usage

• SWD Hardware debugger requried (J-Link, ST-Link, etc)

• Basic software installation (Nordic nrfjprog utility or OpenOCD)

• Minimal extra hardware (jumper wires, optional pogo pins)

• No soldering

• No physical disassembly

• No coding/decompiling

Semi-Technical Background

The bed remotes are based on a microcontroller (nRF52810) which stores the remote's firmware and settings together on the chip. During the pairing process, the bed's base and remote control agree on a key. The key is stored in the remote's flash memory and should only change if the pairing process is repeated. During the manufacturing process, firmware is flashed onto the remote using test pads accessible inside the battery compartment. Using these same pads, our job is to read the memory from one remote and upload it to the other - essentially cloning the paired remote.

Warnings/Caveats/Assumptions

Perform at your own risk! I'm here to share my experiences and will not provide additional support for this process! Both of my remotes are the same model number and were shipped with the same software (although they were manufactured 18 weeks apart). I assume that remotes from this generation are all based on the same nRF52 chipset with different software (and buttons) depending on what each base supports. This process reads/clones the original remote's entire flash memory. This is a very blunt approach and a more surgical approach could be used to read the specific areas of memory where the pairing information is kept. Sure it would be more elegant, but this method worked just fine for me!

Hardware Needed

• Second Tempur ERGO remote

  • Model: KEESON RF396B

  • https://www.tempurpedic.com/other-products/wireless-remote-control/v/3982/

• SWD Programmer

  • I used a Segger J-Link (Education Version) but there are multiple SWD debugger options at a variety of price points

  • Knock-off ST-Link is around $10

  • Take care to use the proper pins based on the pinout list below.

  • Note: Segger provides firmware for converting a low-cost ST-Link board into a J-Link.

    • https://www.segger.com/products/debug-probes/j-link/models/other-j-links/st-link-on-board/

    • https://www.radioshuttle.de/en/turtle-en/nucleo-st-link-interface-en/

• Jumper Wires

  • Set of Male-Male, Male-Female, Female-Female breadboard jumper wires is around $7 online

    • I prefer the rainbow pull-apart sets. Strip off the four wires you need and tape the ends together in a row - this makes them easier to handle during the read/flash process.

• Optional - Stacking Header

  • Alternative to taping the connectors together, holds jumper wire ends together in a row.

• Optional - Pogo Pins

  • Insert these into the pin header for an easier time holding the pins in-place during the procedure

Software Needed

• Nordic nRF Command Line Tools (nrfjprog)

  • https://www.nordicsemi.com/Products/Development-tools/nrf-command-line-tools/download

  • Note: OpenOCD will likely work as well, but I didn't test this.

Remote Control Test Pad Pinout (See Photos!)

Note: Located inside battery compartment between AAA's, Pinout listed from top [Square Pad] to Bottom:

1. Power/VREF (J-Link Pin 1)

2. SWDIO (J Link Pin 2)

3. SWDCLK (J Link Pin 9)

4. Ground (J Link Pin 4)

5. "Test" (Not Used for Debugger)

Detailed Procedure

1 - Prepare Remotes

• Insert batteries into both remotes

• Pair primary remote and confirm functionality

• Open battery compartment of each remote (leave batteries installed!)

• Look between batteries and identify programming pads on circuit board.

2 - Obtain the necessary hardware (Listed above)

• Note: ST-Link might require a firmware flash to be used with nrfJprog

3 - Install command line tools (nrfjprog) from Nordic's utility download website

• https://www.nordicsemi.com/Products/Development-tools/nrf-command-line-tools/download

• Alternative/Un-tested: this process will likely work with OpenOCD - use the appropriate commands/flags to accomplish the remaining read/write tasks. User may need to specify device id's or COM ports, etc. depending on operating system.

• Verify successful installation by opening a command prompt / terminal and using the following command:

###> nrfjprog --version

nrfjprog version: 10.24.0 external
JLinkARM.dll version: 7.94e

4 - Connect jumper wires to SWD Debugger

• Note: When connecting the debugger to the remote test pads, I inserted pogo pins into a stacking header. I then used jumper wires to connect the header to the debugger. The pogo pins were nice because they aren't as difficult to hold in place during the procedure.

5 - Connect J-Link to primary remote (w/ batteries) and dump memory

• Align and hold the header pins against the primary remote's programming pads.

• Enter the following command:

###> nrfjprog --readcode main_remote_dump.hex

Storing data in 'main_remote_dump.hex'.

6 - (Optional but recommended!) Connect J-Link to second remote (w/ batteries) and dump memory

• Align and hold the header pins against the secondary remote's programming pads.

• Enter the following command:

###> nrfjprog --readcode new_remote_dump.hex

Storing data in 'new_remote_dump.hex'.

7 - (Optional but recommended!) Compare both .hex files using diff command (Mac/Linux)

• Both files should be mostly similar. My assumption is that main difference is a stored value for the pairing information, maybe a remote serial number. Otherwise the firmware should be the same and there shouldn't be much output for the following command.

• Enter the following command:

###> diff main_remote_dump.hex new_remote_dump.hex

266c266
< :1010800003F04CFD202269461348FFF777F900264C
---
> :101080009E020000202269461348FFF777F90026E8
12036,12037c12036,12037
< :10F0000011000000BF000000810000002600000089
< :10F01000B700000090000000FF000000FF000000AB
---
> :10F000004C000000D9000000930000006D000000DB
> :10F010005D000000C0000000FF000000FF000000D5

8 - Flash second remote with original dump file

• Align and hold the header pins against the secondary remote's programming pads.

• Enter the following command:

###> nrfjprog --program main_remote_dump.hex --chiperase --verify
[ #################### ]   0.194s | Erase file - Done erasing
[ #################### ]   2.198s | Program file - Done programming
[ #################### ]   1.264s | Verify file - Done verifying

9 - Remove then re-insert battery from second remote

• If successful, both remotes should control the bed!

Troubleshooting:

1 - If you're having trouble with the connection process Confirm the following:

• Confirm that the header/pogo pins are in the correct orientation

• Confirm that the header/pogo pins are connected to the proper j-link pins

• Hold programming header firmly throughout the programming/reading process

2 - This guide was written using a J-Link and the Nordic nRF "nrfjprog" tool, if you elect to use OpenOCD or an ST-Link debugger, ensure that you're using the appropriate command line flags, that your debugger has the correct firmware installed, and any other requirements based on your operating system or devices!

3 - If the header/pogo pins aren't making a proper connection, you will likely receive the following error message:

Thanks for reading and good luck!